如何按用户帐户过滤mysql审计日志

Question

我的问题是即使我从审核日志中禁用 root 用户，但仍然为这些用户进行日志记录。任何人请帮忙。这是我一步一步做的。

[Setp -1] 检查审计日志变量。

mysql> SHOW VARIABLES LIKE 'audit_log%';
+-----------------------------+--------------+
| Variable_name               | Value        |
+-----------------------------+--------------+
| audit_log_buffer_size       | 1048576      |
| audit_log_connection_policy | ALL          |
| audit_log_current_session   | ON           |
| audit_log_exclude_accounts  |              |
| audit_log_file              | audit.log    |
| audit_log_flush             | OFF          |
| audit_log_format            | OLD          |
| audit_log_include_accounts  |              |
| audit_log_policy            | ALL          |
| audit_log_rotate_on_size    | 0            |
| audit_log_statement_policy  | ALL          |
| audit_log_strategy          | ASYNCHRONOUS |
+-----------------------------+--------------+
12 rows in set (0.00 sec)

[Setp-2] 以下语句是禁用 root 帐户的审核日志记录。

-- audit_log_include_accounts to NULL
SET GLOBAL audit_log_include_accounts = NULL;
SET GLOBAL audit_log_exclude_accounts = root@%;

注意：我使用 root@% 代替 root@localhost 因为这个数据库服务器可以从另一个 IP 地址访问。

[Setp-3] 我从远程 PC 调用 select 语句 SELECT * FROM SSVR_AUDIT_LOG。

[Step-4] 我检查了数据库服务器中的审核日志。

 <AUDIT_RECORD TIMESTAMP="2016-04-22T03:49:11 UTC" RECORD_ID="593_2016-04-22T01:28:17" NAME="Query" CONNECTION_ID="6" STATUS="0" STATUS_CODE="0" USER="root[root] @  [162.16.22.48]" OS_LOGIN="" HOST="" IP="162.16.22.48" COMMAND_CLASS="show_create_table" SQLTEXT="SHOW CREATE TABLE `SSVR_AUDIT_LOG`"/>
  <AUDIT_RECORD TIMESTAMP="2016-04-22T03:49:12 UTC" RECORD_ID="594_2016-04-22T01:28:17" NAME="Query" CONNECTION_ID="7" STATUS="0" STATUS_CODE="0" USER="root[root] @  [162.16.22.48]" OS_LOGIN="" HOST="" IP="162.16.22.48" COMMAND_CLASS="select" SQLTEXT="SELECT * FROM `SSVR_AUDIT_LOG` LIMIT 0, 1000"/>
  <AUDIT_RECORD TIMESTAMP="2016-04-22T03:49:12 UTC" RECORD_ID="595_2016-04-22T01:28:17" NAME="Query" CONNECTION_ID="7" STATUS="0" STATUS_CODE="0" USER="root[root] @  [162.16.22.48]" OS_LOGIN="" HOST="" IP="162.16.22.48" COMMAND_CLASS="show_fields" SQLTEXT="SHOW COLUMNS FROM `tldssvr`.`SSVR_AUDIT_LOG`"/>
  <AUDIT_RECORD TIMESTAMP="2016-04-22T03:49:13 UTC" RECORD_ID="596_2016-04-22T01:28:17" NAME="Quit" CONNECTION_ID="7" STATUS="0" STATUS_CODE="0" USER="root" OS_LOGIN="" HOST="" IP="162.16.22.48" COMMAND_CLASS="connect"/>

这是我的参考链接enter link description here

Answer 1

我的问题得到了答案。这里是正确答案。当您遇到此类问题时，您可以按照以下步骤操作。

按帐户过滤审核日志

1. 列出所有“审计日志”配置项

>	mysql -u root -p
>	SHOW VARIABLES LIKE ‘audit_log%’;
+-----------------------------+--------------+
| Variable_name               | Value        |
+-----------------------------+--------------+
| audit_log_buffer_size       | 1048576      |
| audit_log_connection_policy | ALL          |
| audit_log_current_session   | OFF          |
| audit_log_exclude_accounts  |              |
| audit_log_file              | audit.log    |
| audit_log_flush             | OFF          |
| audit_log_format            | OLD          |
| audit_log_include_accounts  |              |
| audit_log_policy            | ALL          |
| audit_log_rotate_on_size    | 0            |
| audit_log_statement_policy  | ALL          |
| audit_log_strategy          | ASYNCHRONOUS |
+-----------------------------+--------------+

1. 在数据库服务器中添加远程应用服务器主机名和IP地址。

   > cat /etc/hosts
   > 127.0.0.1   localhost localhost.localdomain localhost4  localhost4.localdomain4
     162.16.22.48 App_PC
    ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

2. 仅为应用程序数据库用户 (root) 本地主机和远程主机帐户禁用审核日志记录。

> mysql –u root –p
>SET GLOBAL audit_log_include_accounts = NULL;
>SET GLOBAL audit_log_exclude_accounts = 'root@localhost,root@App_PC';

4. 列出所有“审计日志”配置项并检查 audit_log_exclude_account 值。

> SHOW VARIABLES LIKE 'audit_log%';
> +-----------------------------+----------------------------+
| Variable_name               | Value                      |
+-----------------------------+----------------------------+
| audit_log_buffer_size       | 1048576                    |
| audit_log_connection_policy | ALL                        |
| audit_log_current_session   | OFF                        |
| audit_log_exclude_accounts  | root@localhost,root@App_PC |
| audit_log_file              | audit.log                  |
| audit_log_flush             | OFF                        |
| audit_log_format            | OLD                        |
| audit_log_include_accounts  |                            |
| audit_log_policy            | ALL                        |
| audit_log_rotate_on_size    | 0                          |
| audit_log_statement_policy  | ALL                        |
| audit_log_strategy          | ASYNCHRONOUS               |
+-----------------------------+----------------------------+